{
  "id": "CB-M365-TENANT-020",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-020",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-020.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-020.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-TENANT-020",
    "title": "Restrict Copilot web search, agents and third-party AI providers",
    "finding": {
      "title": "Copilot can reach the web, run any agent and use third-party AI models without review",
      "description": "Prompts and grounding data can be sent to Bing or to third-party model providers, and users can install or share agents that have not been assessed."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "copilot",
      "ai",
      "agents",
      "web-search",
      "data-protection"
    ],
    "applicability": {
      "requires": [
        "Microsoft 365 Copilot"
      ]
    },
    "description": "Microsoft 365 Copilot settings follow a decision recorded by the organization (data protection\nofficer and security team) and, by default in this profile:\n\n- **Web search** (web grounding in Microsoft 365 Copilot and Copilot Chat) is turned off, or\n  limited to groups whose use case was assessed;\n- **agents**: access is limited to selected groups, sharing agents with the entire organization\n  is limited to administrators, and only agents built by the organization or approved in\n  **Integrated apps** can be installed;\n- **AI providers operating as Microsoft subprocessors** (such as Anthropic models) are off until\n  an assessment covers data location and processing terms;\n- **self-service trials and purchases** of Copilot are not allowed.\n",
    "rationale": "Web grounding sends generated search queries, derived from prompts and work content, to Bing,\noutside the Microsoft 365 service boundary. Third-party model providers process prompts under\nseparate terms, which matters under GDPR and for data sovereignty. Agents and their connectors\nact with the user's permissions and can reach external services. Each of these features widens\nwhere work data goes, so it should be enabled by decision, not by default.\n",
    "impact": "Users lose web answers in Copilot and access to agents that are not approved; they request them.\nCopilot features change often: review these settings at each major announcement.\n",
    "notes": "This control is drawn from the ASD Blueprint and will be revisited when CIS or SCuBA publish\nCopilot rules. Copilot Studio agents are covered in the POWER domain, agent identities in the\nAPPS domain.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft 365 admin center (https://admin.cloud.microsoft) as at least a\n   Global Reader (AI Administrator for Copilot settings).\n2. Browse to **Copilot** > **Settings** and open:\n   - **Web search**: check how web search is controlled (the Cloud Policy setting **Allow web\n     search in Copilot** in the Microsoft 365 Apps admin center, https://config.office.com) and\n     that it is disabled or scoped to assessed groups;\n   - **Data access** > **AI providers operating as Microsoft subprocessors**: third-party\n     providers are disabled;\n   - **User access** > **Microsoft 365 Copilot self-service purchases**: **Do not allow**.\n3. Browse to **Agents** > **Settings** (or **Copilot** > **Agents**): **Allowed agent types**,\n   **Sharing** and **User access** are limited as described.\n4. Browse to **Settings** > **Integrated apps** and check that each available agent is\n   approved.\n5. Fail if any of these settings is open to all users without a recorded decision.\n"
    },
    "remediation": {
      "manual": "1. With an AI Administrator or Global Administrator, record the organization's decision for\n   each feature.\n2. In the Microsoft 365 Apps admin center (https://config.office.com) > **Customization** >\n   **Policy Management**, create or edit a policy with **Allow web search in Copilot** set to\n   **Disabled** (or enabled only for an assessed group), with an Office Apps Administrator.\n3. In the Microsoft 365 admin center, **Copilot** > **Settings** > **Data access**, disable the\n   third-party AI subprocessors; **User access**, set self-service purchases to **Do not\n   allow**.\n4. In **Agents** > **Settings**, limit allowed agent types to those built by the organization\n   and approved ones, sharing to administrators, and access to selected groups.\n5. Block or remove unapproved agents in **Settings** > **Integrated apps**.\n",
      "rollback": "Re-enable the features in the same pages.\n"
    },
    "references": [
      {
        "title": "Configure Microsoft Copilot settings in the Microsoft 365 admin center",
        "url": "https://learn.microsoft.com/copilot/microsoft-365/microsoft-365-copilot-page",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Manage web search in Microsoft 365 Copilot and Copilot Chat",
        "url": "https://learn.microsoft.com/copilot/microsoft-365/manage-public-web-access",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Manage agents for Microsoft 365 Copilot in the Microsoft 365 admin center",
        "url": "https://learn.microsoft.com/microsoft-365/admin/manage/manage-copilot-agents-integrated-apps",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "ASD's Blueprint for Secure Cloud, Copilot settings",
        "url": "https://blueprint.asd.gov.au/configuration/microsoft-365/copilot/settings/",
        "publisher": "Australian Signals Directorate",
        "kind": "guide",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-4",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SA-9",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-POWER-022",
        "type": "related"
      },
      {
        "id": "CB-M365-APPS-018",
        "type": "related"
      },
      {
        "id": "CB-M365-APPS-019",
        "type": "related"
      },
      {
        "id": "CB-M365-POWER-024",
        "type": "related"
      },
      {
        "id": "CB-M365-DATA-004",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}